CVE-2026-35075
This vulnerability allows an attacker to read a hard‑coded password from the firmware of certain MBS Solutions gateway devices. Because the password is stored in plain text, the attacker can log in as an administrator and control the device. The flaw is exploitable over the network without any credentials.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
MBS Solutions Universal Gateway firmware and various Double‑A, Double‑X, Single‑A, Single‑X, and Triple‑X gateway products (e.g., double‑a_profibus, double‑x_can, triple‑x_knx+dali, etc.).
Real-world impact
An attacker who can read the firmware image can obtain the default password and then log in with full administrative rights, allowing them to reconfigure, disable, or hijack the device.
Why this severity
The CVSS score of 9.3 reflects that the flaw is remotely exploitable (AV:N), requires no authentication (PR:N), and gives the attacker complete control over the device, compromising confidentiality, integrity, and availability.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Jun 3, 2026 · Jun 3, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 22, 2026 · 13d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- certvde.com/en/advisories/VDE-2026-039/vendor advisory